S328 · Current-task production writer guard integration

/// Commit the exact CPU1 owner into the real scheduler current task and then
/// release the exact S198 token before restoring local IRQ state.
///
/// # Safety
///
/// This is a production global-scheduler access. The caller must enter only
/// through the complete S203 guard. S328 adds shared-gate membership for this
/// one writer only; 68 legacy scheduler accesses remain outside it, so this
/// adapter is still wired but not invoked and generic-SMP exclusion is not
/// claimed.
#[cfg(all(target_arch = "aarch64", target_os = "none"))]
pub unsafe fn commit_production_current_task_owner(
    runtime: &G8lRuntimeAuthority,
    authority: &G8lSchedulerOwnerAuthority,
    guarded: crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_guarded_ack::G8lProductionSchedulerMutationGuardedAck,
) -> Result<G8lProductionCurrentTaskOwnerCommit, G8lProductionCurrentTaskOwnerCommitError> {
    let (bridge, irq_guard) = guarded.into_bridge_and_irq_guard();
    if let Err(error) = bridge.revalidate(authority, runtime) {
        drop(bridge);
        drop(irq_guard);
        return Err(G8lProductionCurrentTaskOwnerCommitError::Bridge(error));
    }

    #[cfg(feature = "board-rpi5")]
    let s328_writer_access = match crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s328_current_task_writer_guard_integration::acquire_s328_production_scheduler_writer_access(
        bridge.caller_cpu(),
    ) {
        Ok(access) => access,
        Err(error) => {
            drop(bridge);
            drop(irq_guard);
            return Err(G8lProductionCurrentTaskOwnerCommitError::WriterAccess(error));
        }
    };

    let scheduler = &mut *core::ptr::addr_of_mut!(crate::task::scheduler::SCHEDULER);
    let scheduler_receipt =
        match scheduler.commit_g8l_current_task_owner(runtime, authority, &bridge) {
            Ok(receipt) => receipt,
            Err(error) => {
                drop(bridge);
                #[cfg(feature = "board-rpi5")]
                drop(s328_writer_access);
                drop(irq_guard);
                return Err(G8lProductionCurrentTaskOwnerCommitError::Scheduler(error));
            }
        };

    let release = match crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_guarded_ack_release::G8lProductionSchedulerMutationGuardedAckRelease::from_bridge(
        runtime,
        authority,
        bridge,
    ) {
        Ok(release) => release,
        Err(error) => {
            let rollback = scheduler.rollback_g8l_current_task_owner(scheduler_receipt);
            #[cfg(feature = "board-rpi5")]
            drop(s328_writer_access);
            drop(irq_guard);
            return match rollback {
                Ok(()) => Err(G8lProductionCurrentTaskOwnerCommitError::Release(error)),
                Err(rollback) => Err(G8lProductionCurrentTaskOwnerCommitError::Rollback(rollback)),
            };
        }
    };

    let release = match crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_guarded_ack_release_receipt::G8lProductionSchedulerMutationGuardedAckReleaseReceipt::from_release(
        runtime,
        authority,
        release,
    ) {
        Ok(release) => release,
        Err(error) => {
            let rollback = scheduler.rollback_g8l_current_task_owner(scheduler_receipt);
            #[cfg(feature = "board-rpi5")]
            drop(s328_writer_access);
            drop(irq_guard);
            return match rollback {
                Ok(()) => Err(
                    G8lProductionCurrentTaskOwnerCommitError::ReleaseAcknowledgement(error),
                ),
                Err(rollback) => Err(G8lProductionCurrentTaskOwnerCommitError::Rollback(rollback)),
            };
        }
    };

    if release.token() != scheduler_receipt.exclusion_token
        || release.task_id() != scheduler_receipt.task_id
        || release.caller_cpu() != scheduler_receipt.owner_cpu
        || release.owner_epoch() != scheduler_receipt.owner_epoch
    {
        let rollback = scheduler.rollback_g8l_current_task_owner(scheduler_receipt);
        #[cfg(feature = "board-rpi5")]
        drop(s328_writer_access);
        drop(irq_guard);
        return match rollback {
            Ok(()) => Err(G8lProductionCurrentTaskOwnerCommitError::ReleaseIdentityMismatch),
            Err(rollback) => Err(G8lProductionCurrentTaskOwnerCommitError::Rollback(rollback)),
        };
    }

    let release = release.into_receipt();
    #[cfg(feature = "board-rpi5")]
    drop(s328_writer_access);
    drop(irq_guard);
    Ok(G8lProductionCurrentTaskOwnerCommit {
        scheduler: scheduler_receipt,
        release,
    })
}

/// Acquire writer membership from the exact static gate used by production
/// readers. The caller must already hold the S203 local-IRQ guard; this
/// function validates the real CPU identity and does not manufacture it.
#[cfg(all(target_arch = "aarch64", target_os = "none", feature = "board-rpi5"))]
pub fn acquire_s328_production_scheduler_writer_access(
    caller_cpu: usize,
) -> Result<G8lS328ProductionSchedulerWriterAccess, G8lS247WholeSchedulerAccessError> {
    use crate::g8l_runtime_contract::CPU1;

    let current_cpu =
        crate::percpu::try_current_cpu_id().ok_or(G8lS247WholeSchedulerAccessError::InvalidCpu)?;
    if current_cpu != CPU1 || caller_cpu != current_cpu {
        return Err(G8lS247WholeSchedulerAccessError::InvalidCpu);
    }
    let access = crate::g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s246_whole_scheduler_read_access_guard::S247_PRODUCTION_WHOLE_SCHEDULER_ACCESS_GATE
        .try_acquire_exclusive(caller_cpu)?;
    Ok(G8lS328ProductionSchedulerWriterAccess { _access: access })
}

#[test]
fn production_current_task_order_is_revalidate_guard_mutate_release() {
    let source = include_str!(
        "../../kernel/src/g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_current_task.rs"
    );
    let production = source
        .split("pub unsafe fn commit_production_current_task_owner")
        .nth(1)
        .unwrap();
    let revalidate = production.find("bridge.revalidate").unwrap();
    let acquire = production
        .find("acquire_s328_production_scheduler_writer_access")
        .unwrap();
    let writer = production
        .find("addr_of_mut!(crate::task::scheduler::SCHEDULER)")
        .unwrap();
    let commit = production.find("commit_g8l_current_task_owner").unwrap();
    let release = production.find("from_bridge").unwrap();
    let success = production
        .find("let release = release.into_receipt()")
        .unwrap();
    let drop_writer = production[success..]
        .find("drop(s328_writer_access)")
        .unwrap()
        + success;
    let restore_irq = production[drop_writer..].find("drop(irq_guard)").unwrap() + drop_writer;
    assert!(
        revalidate < acquire
            && acquire < writer
            && writer < commit
            && commit < release
            && release < drop_writer
            && drop_writer < restore_irq
    );
}

  {
    id: "g8l-s328-current-task-writer-guard-integration-partial",
    date: "2026-08-27",
    sequence: 328,
    status: "passed",
    umbrella_status: "partial",
    title: "S328 · Current-task production writer guard integration",
    summary:
      "S328 current-task production adapterındaki tek mutable SCHEDULER writer'ını, 44 production reader'ın kullandığı aynı statik S247 gate'e bağlar. Exact S203 revalidation → writer membership → real commit → rollback/S198 release/ACK → writer release → IRQ restore sırası kaynak-kilitlidir. Guarded writer 1/69, açık writer 68 ve provider authority 0'dır; S245 request tüketilmez.",
    evidence: [
      "Focused writer-integration kapısı iki bağımsız koşuda 19/19 PASS: 134 B / SHA-256 d123478fc3b1529e55bbd7cf001455847b321973c9b53098e11978a7dd59b95d.",
      "Aynı S247 state word üzerinde reader→writer ve writer→reader exclusion, nonzero monotonic token, wrong-CPU rejection ve commit-error exact release/no-retry yolları doğrulandı.",
      "Current-task adapterında acquire_s328_production_scheduler_writer_access gerçek addr_of_mut!(...SCHEDULER) öncesindedir; tüm post-acquisition çıkışlar writer membership'i local IRQ restore'dan önce bırakır.",
      "QEMU, RPi4, RPi5 ve RPi5+SMP AArch64 compile profilleri exit 0 verdi; warning header'ları 291/389/1091/1091, zero-warning iddiası yoktur.",
      "Operations komut haritasından türetilen S238–S328 matrisi iki bağımsız koşuda 92 grup / 1308/1308 PASS; süre-normalize çıktılar 12070 B / SHA-256 74aa344082512b0de09273903a3dbfc015c5e8cd2fb6f9e444bae2b5822ae485 ile byte-eşittir.",
      "Exact yedi tarihsel G8h assertion adı dışlandığında tam workspace iki koşuda 290 sonuç grubu / 3125 PASS / 0 fail / 7 filtered verdi; normalize sonuç özeti 32710 B / SHA-256 dc7370f34908ae32144581777440413d26358af0557c3c8da449c299c526b4d6 ile byte-eşittir. Filtresiz audit frozen S96 exceptions.S identity kapısında RED olduğu için global workspace GREEN iddia edilmez.",
      "make verify-qemu iki bağımsız PASS verdi: strict ELF W^X 31/31 ve aynı 1551 B / SHA-256 527ef12c2bc56140e14e13be445f78c8e38872febc9849afcfacd499238ff966 acceptance özeti korundu. Bu ortak regresyon S328 runtime invocation kanıtı değildir.",
      "Yerel website 502/502 test, lint, TypeScript ve 23/23 static route PASS; çıktı 193 dosyadır. S328 Operations/Timeline/Yol Haritası marker'ları yerel artifact'ta doğrulandı, deployment yapılmadı.",
      "Project-status JSON/renderer kapıları ve manifest testi iki bağımsız koşuda 211/211 PASS; 345 B ham çıktılar yalnız süre alanında ayrıştı, süre-normalize 347 B çıktı SHA-256 2ec7336b9d00b2e01b302b97b0d80b5d01d9bb294fe5a7dbd6c0cae711b5e171 ile birebirdir.",
      "S245 request ve S244 admission dokunulmadan kalır; production provider authority=0, whole-scheduler exclusion=false, runtime invocation=false.",
      "Fiziksel/device işlem yapılmadı: physical/device operations=0 ve RUNBOOK_EXECUTED_IN_S328=NO.",
    ],
    commands: [
      "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s328_current_task_writer_guard_integration -- --test-threads=1",
      "cargo check -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5",
      "cargo check -p aselsan_kernel --target aarch64-unknown-none --no-default-features --features board-rpi5,smp",
    ],
    terminalSessions: [
      {
        id: "g8l-s328-current-task-writer-guard-integration",
        title: "G8l S328 current-task writer guard integration",
        commandLines: [
          "cargo test --quiet -p aselsan_microkernel_simulation --test g8l_target_dispatch_scheduler_owner_scheduler_mutation_production_migration_lifecycle_s328_current_task_writer_guard_integration -- --test-threads=1",
        ],
        outputLines: [
          "test result: ok; S328 focused 1 group / 19 passed; 0 failed",
          "shared S247 gate: 44 guarded readers + 1/69 guarded writer; 68 writers open",
          "provider authority=0; S245 request not taken; S244 admission not published",
        ],
        exitCode: 0,
        outputMode: "complete",
      },
    ],
    terminalSessionsNote:
      "S328 ilk production writer'ın kaynak entegrasyonudur; entrypoint runtime'da çağrılmadı ve global exclusion oluşmadı.",
    limitations: [
      "68 production writer aynı shared gate dışında kaldığı için whole-scheduler exclusion ve provider authority açık kalır.",
      "Supported-profile runtime invocation, Generic SMP ve fiziksel RPi kabulü açık kalır.",
    ],
  },